The traditional algorithms for packets-based pattern matching are unable to meet the needs of the network behavior management system if data packets flow through the network in TCP streams. After presenting an efficient algorithm for restructuring TCP session streams
this paper discusses detailedly solution to the problems appeared in multiple connection management
repeatable message processing
out-of order message processing and etc. Finally
we implement the interception and analysis of data packets complying to the FTP protocol by means of the algorithm. Comparing with the Libnids library
the experimental results demonstrates that our algorithm is more efficient and stable.